Bump Spring Boot from 3.1.4 to 3.3.11

[nthmost-orkes]

Summary

• Bumps Spring Boot gradle plugin (and BOM) from 3.1.4 to 3.3.11
• This updates all Spring-managed transitive dependencies including Tomcat, Spring Framework, etc.

Vulnerabilities Fixed

CVE	Library	Severity	Description
CVE-2025-55752	tomcat-embed-core	HIGH	Directory traversal with possible RCE
CVE-2025-48988	tomcat-embed-core	HIGH	DoS in multipart upload
CVE-2025-48989	tomcat-embed-core	HIGH	HTTP/2 MadeYouReset DoS
CVE-2025-22235	spring-boot	HIGH	EndpointRequest.to() wrong matcher
CVE-2025-41249	spring-core	HIGH	Annotation detection vulnerability

Notes

• Spring Boot 3.3.x is a minor version bump from 3.1.x — review Spring Boot migration guides for breaking changes
• The Elasticsearch version override and Groovy override in springboot-bom-overrides.gradle are preserved

Test plan

• Verify Gradle build succeeds
• Run integration tests
• Verify server starts and basic API operations work